What is the downside of NOT running AWS Lambda functions in a VPC?

Question

I am running AWS Lambda functions in a VPC.

And during the course of the project I have hit problems because:

no access to my database - had to solve this somehow
no access to AWS SES - had to find workaround
no access to AWS SQS -removed all queuing functionality from Lambda functions
no access to external Internet - still don't know how to implement ReCapthca without Internet access
no access to AWS Cognito - cannot get information about logged in users

I COULD implement a NAT gateway in the VPC but what is the point of serverless if I have to run a NAT server instance? That's not serverless.

So finally AWS has worn me down and I have decided to give up on running my AWS Lambda functions in a VPC - without endpoints for Internet proxying and the various AWS services its just too hard.

SO my question is - what is the downside/disadvantage of running my AWS Lambda functions with no VPC?

user_1876739 · Answer

AWS has provided a reference document for Lambda deployments: Serverless Application Lens, AWS Well-Architected Framework. In it they provide the following decision tree:

Decision tree for deploying a Lambda function in a VPC

The only major downside noted is that a Lambda outside of a VPC cannot directly access private resources within a VPC.

user_4278509 · Answer

One reason to create a Lambda in a VPC would be that you have a specific IP or IP range for it. This could be the case if a system just accepts calls from a specific IP which would need to be whitlistet for it.

Fix IP for Lambda function is discussed here: Is there a way to assign a Static IP to a AWS Lambda without VPC?

Downside of not having Lambda in VPC: Not having specific IP / IP-range for your Lambda function.

What is the downside of NOT running AWS Lambda functions in a VPC?

4 Answers